StealC: Cheat Tool to Emptied Wallet
A gamer chasing a free aimbot ran a fake cheat-tool installer, and within the hour the PC was beaconing to the internet and pinning its CPU. Follow the trail from a search-driven lure and an abused download through StealC's Run-key persistence and credential, wallet, clipboard, and screenshot theft to its HTTP exfiltration and a second-stage cryptojacker.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Open the case
0A home gaming PC started behaving oddly tonight: a sudden burst of outbound web traffic and a fan that will not stop spinning. The owner admits they went looking for a free game cheat earlier in the evening. You have the household web-filter, DNS, and endpoint records for the machine. Get oriented before you start pulling threads.
Trace the lure
20The intrusion began with a search for a cheat, not with an email. One site funneled the user toward the download. Working from the web-filter egress records, identify the site that served the fake cheat-tool landing page.
Identify what was run
20The download was a ZIP, but the harm came from the file the user ran out of it. On the endpoint, one process is the root of everything that follows. Name the executable the user launched.
Fingerprint the sample
20To check the binary against threat intelligence and to scope whether it landed elsewhere, you need its file hash. Recover the cryptographic hash recorded for the executable that was run.
Cut off the theft
20Once running, the binary harvested credentials, cookies, wallets, the clipboard, and a screenshot, then shipped the loot out. To contain the host and block the channel, identify the single host that received the stolen data.
Classify the second stage
20The intrusion did not stop at theft. After exfiltration, the stealer pulled a second payload from a different host and ran it to monetize the machine itself. Map that final objective to its MITRE ATT&CK technique.
6 tasks · 100 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.